GitVenom: Fake GitHub Repositories Spreading Malware to Developers

Overview

A newly exposed malware campaign, GitVenom, is using fake GitHub repositories to infect developers with credential-stealing malware, cryptocurrency hijackers, and remote administration tools (RATs). Researchers from Kaspersky’s Securelist uncovered the attack, revealing that malicious actors are disguising their malware as open-source projects to deceive unsuspecting developers.

How GitVenom Works

1️⃣ Fake GitHub Repositories

• Attackers create fake open-source projects on GitHub, mimicking real tools such as:
  ✅ Instagram automation software
  ✅ Telegram Bitcoin wallet bots
  ✅ Valorant hacking tools
• They enhance credibility by:
  ✅ Writing AI-generated README.md files with detailed descriptions
  ✅ Using SEO tactics like excessive tags
  ✅ Faking commit history by manipulating timestamps

2️⃣ Hidden Malicious Code

Depending on the programming language, malware is hidden differently:

• Python: Encoded in long tab characters (~2000), which decrypt and execute a secondary script
• JavaScript: Malicious functions hidden within project files
• C, C++, C#: Batch scripts embedded in Visual Studio project files execute during build

3️⃣ Malware Payloads and Data Theft

Once executed, the malware downloads additional components from attacker-controlled GitHub repositories, including:

• Node.js-based infostealers – Extract passwords, banking details, crypto wallets, and browser history
• AsyncRAT & Quasar RAT – Grant remote control over infected systems
• Clipboard Hijacker – Replaces copied crypto wallet addresses with attacker-controlled addresses
  🔴 At least 5 BTC (~$485,000 USD) were stolen in November 2024